061e96bfa9aa171ebfcb9d928f8c4b5d8e1dad5b1e09c06587d5d5bb8e63e685

Analysis

max time kernel
149s
max time network
128s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EcMenu_v1.6/Files/Readme.txt
Size 621B
Sample260508-sfbdmsdy9p
SHA256 061e96bfa9aa171ebfcb9d928f8c4b5d8e1dad5b1e09c06587d5d5bb8e63e685
MD5 faa52e981ab875e7f7ce2941177f1614
SHA1 21d8a91173cae0fe58b957e3cdb7096c6b8373c0
SHA512 aec41f119d3fb70072406576a39a6507ada872b2bd99b8c918097573fe7bf8eb2861983a5ede0b90caee33f17e724d9f2b0ccf96fe2f674e1642a21f25f1bebb
TLSH
T1CFF02D965286177AF6E1B121364F0CD5C34ACACDB7654A2404A8D44D37D3BB143FE5F0
MD5 SHA1 SHA512 TLSH

Score

3^/10

ransomware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4980	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 4980	3048	cmd.exe	78

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\EcMenu_v1.6\Files\Readme.txt
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\EcMenu_v1.6\Files\Readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads